Zero-Day Malware Behavior Predictor
A full-stack malware analysis platform that reads what a file is capable of instead of asking whether anyone has seen it before. It extracts behavioural artefacts statically, maps them onto MITRE ATT&CK techniques, and passes the resulting summary — never the raw file — to a language model that infers intent and refines the risk score.
Pipeline
- File upload
- Metadata & hashing
- Static behavioural scan
- MITRE ATT&CK mapping
- LLM intent inference
- Dual risk score
- Remediation plan
Problem
Signature matching answers a question about the past: has this exact artefact been seen and catalogued? Zero-day malware fails that test by definition, and modern tradecraft makes it worse — fileless execution and living-off-the-land abuse mean the malicious logic may never touch disk as a recognisable binary at all.
Dynamic sandboxes answer a better question but at a cost: they are heavy, and advanced samples detect and evade them. That leaves a gap for pre-execution reasoning about intent.
Approach
The analysis is deliberately hybrid. A deterministic pass extracts observable capabilities — network downloaders, in-memory execution, credential access, registry persistence, obfuscation — and those get mapped onto standardised ATT&CK techniques so the finding is expressible in the language a defender already uses.
Only then does the language model see anything, and what it sees is the behavioural summary rather than the file. It infers a primary intent with a confidence value, adjusts the static risk score with a written justification, and produces an analyst-facing overview. Keeping raw content away from the model is a hallucination control, not a performance optimisation.
Implementation notes
- Dual risk scoring — the static score and the AI-adjusted score are reported separately, so the model's contribution to a verdict is visible instead of blended away.
- Structured output — the LLM is constrained to strict JSON schemas, with fallback defaults so the platform degrades to pure static analysis when the model is unavailable or over quota.
- Recommendations are tiered into immediate, cleanup and preventive actions rather than a single undifferentiated list.
- Django backend with MongoDB for analysis records; Next.js and React frontend for upload and the results dashboard.
Limitations
This is static analysis, so runtime-only behaviour is invisible to it, and heavily obfuscated code can slip past pattern extraction — the same obfuscation that defeats the regex pass also starves the model of anything to reason about. A low score is evidence, not a guarantee.